BeCuriouzLearn something new every day
Why ransomware gangs steal your files before locking them
💡 Ransomware now steals data as well as encrypting it, so backups alone no longer neutralize the threat — prevention and access controls matter just as much as recovery.
Ransomware is malware that encrypts your files and demands payment for the key. The clever part is the cryptography: modern strains use asymmetric (public-key) encryption. The malware generates a random symmetric key to scramble your files fast, then encrypts that key with the attacker's public key. Only the criminal's matching private key — which never leaves their server — can unlock it. That's why you can't just 'crack it yourself.'
Good offline backups used to defeat this completely: restore your files and ignore the demand. So attackers evolved. Today most gangs run double extortion — they quietly copy your data before encrypting it, then threaten to publish it unless you pay. Now backups restore your operations but can't un-leak stolen secrets, which is why the threat still works even against well-backed-up victims.
The strongest defenses are layered: immutable, offline backups to recover, plus least-privilege access, patching, and phishing-resistant logins to stop the malware getting in and spreading in the first place. Paying is discouraged — it funds crime and never guarantees a working key.